@DrewDad,
No Drew, you still don't understand.
Your logic is perfect as long as we are only talking about a brute force attack. You are right length of a phrase like "The quick brown fox." makes it very hard to solve using a
brute force attack.
Where you are wrong is the implication that the brute force attack is the only tool hackers have. The password you propose it is relatively easy to solve using a dictionary based attack.
In high security environments, dictionary words are frowned upon. Sometimes there are even filters that keep you from putting dictionary words in your password, although there are downsides to this.
A brute force attack is the primary method for cracking random passwords. This is because any randomly generated password is equally likely to be correct. As soon as a hacker knows that a person is biased on how they will pick their passwords-- for example using dictionary words and "memorizable" phrases, it gives a tool for hackers to focus their search to more likely possibilities.
There is obviously a trade-off here. I believe it is reasonable to choose a password that is less than random in order to make it easier to memorize. Personally I would never choose a password of only dictionary words. I do use initials from sentences with numbers which is a reasonable trade-off in my view.
The technical term is "entropy" which means more or less "randomness". There is no question that higher entropy passwords are more difficult to crack. Random characters have the highest entropy possible.
Statistically based attacks have had success. We know the sequences of characters that humans are more likely to choose and so we can direct our algorithms to favor combinations of these sequences.
